menu_link_attributes 8.x-1.9

Bugfix release for a regression in 8.x-1.8: the security fix for SA-CONTRIB-2026-209 also removed safe container attributes like container_class from the configuration (#3590635).

What's fixed

• Update 8004 and the configuration form now only reject unsafe attribute names (style, on*, invalid names). Safe container_* attributes are kept and can be saved again.
• A new post update restores container attribute definitions that 8.x-1.8 removed, for every container attribute still stored on a menu link.

Upgrade instructions

• Run drush updb.
• With config management: run drush cex afterwards and commit the restored container_* entries in menu_link_attributes.config.yml. Otherwise the next drush cim / drush deploy removes them again.

If you were on 8.x-1.8

• Container attributes of menu links saved through the UI while on 8.x-1.8 are lost and need to be re-entered (or recovered from a database backup taken before updating to 8.x-1.8).
• Container attributes that are no longer stored on any menu link are not restored automatically. Re-add them on the configuration page if needed.

Contributors

acbramley, philltran, koiwo, kmonty